The vulnerability is a cleartext transmission of sensitive information (Cleartext Transmission of Sensitive Information, CWE-319). It allows an unprivileged user who can reach the local network to view live video streams that are intended to be protected. The result is a confidentiality breach that could expose operational video feeds to external observers."

Gallagher NxWitness VMS integration versions prior to 9.10.017 and Gallagher Hanwha VMS integration versions prior to 9.10.025 are affected. The issue resides in components used by these integrations and pertains to local network users only."

The CVSS score of 5.6 indicates moderate overall risk. EPSS is less than 1%, suggesting exploit probability is very low, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector requires local network access; unprivileged users can observe live video streams without needing higher privileges or remote access. Because the data are transmitted in cleartext, an attacker can capture the streams using standard network monitoring tools, posing a data disclosure threat to the organization."